-
Notifications
You must be signed in to change notification settings - Fork 5.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update Semgrep to new container version #2140
Closed
Closed
Changes from all commits
Commits
Show all changes
5 commits
Select commit
Hold shift + click to select a range
c677ecb
Update Semgrep to support container version
GeekMasher d7eb50e
Merge branch 'main' into semgrep-update
GeekMasher bf77d29
Merge branch 'main' into semgrep-update
GeekMasher 424635b
Merge branch 'main' into semgrep-update
GeekMasher 1f46a89
Merge branch 'main' into semgrep-update
GeekMasher File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change | ||||||
---|---|---|---|---|---|---|---|---|
|
@@ -11,35 +11,54 @@ | |||||||
name: Semgrep | ||||||||
|
||||||||
on: | ||||||||
# Scan mainline branches and report all findings: | ||||||||
push: | ||||||||
branches: [ $default-branch, $protected-branches ] | ||||||||
# Scan changed files in PRs (diff-aware scanning): | ||||||||
# The branches below must be a subset of the branches above | ||||||||
pull_request: | ||||||||
# The branches below must be a subset of the branches above | ||||||||
branches: [ $default-branch ] | ||||||||
# Schedule the CI job (this method uses cron syntax): | ||||||||
schedule: | ||||||||
- cron: $cron-weekly | ||||||||
# Scan on-demand through GitHub Actions interface: | ||||||||
workflow_dispatch: {} | ||||||||
|
||||||||
permissions: | ||||||||
contents: read | ||||||||
|
||||||||
jobs: | ||||||||
semgrep: | ||||||||
# User definable name of this GitHub Actions job. | ||||||||
name: semgrep/ci | ||||||||
# If you are self-hosting, change the following `runs-on` value: | ||||||||
runs-on: ubuntu-latest | ||||||||
# Action permissions | ||||||||
permissions: | ||||||||
contents: read # for actions/checkout to fetch code | ||||||||
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results | ||||||||
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status | ||||||||
name: Scan | ||||||||
runs-on: ubuntu-latest | ||||||||
|
||||||||
container: | ||||||||
# A Docker image with Semgrep installed. | ||||||||
image: returntocorp/semgrep:7843a979bf88d9d16c476e9f7f547b573187f395532b1f74825fd58c6463c5b0 | ||||||||
|
||||||||
# Skip any PR created by dependabot to avoid permission issues: | ||||||||
if: (github.actor != 'dependabot[bot]') | ||||||||
|
||||||||
steps: | ||||||||
# Checkout project source | ||||||||
# Fetch project source with GitHub Actions Checkout. | ||||||||
- uses: actions/checkout@v4 | ||||||||
|
||||||||
# Scan code using project's configuration on https://semgrep.dev/manage | ||||||||
- uses: returntocorp/semgrep-action@fcd5ab7459e8d91cb1777481980d1b18b4fc6735 | ||||||||
with: | ||||||||
publishToken: ${{ secrets.SEMGREP_APP_TOKEN }} | ||||||||
publishDeployment: ${{ secrets.SEMGREP_DEPLOYMENT_ID }} | ||||||||
generateSarif: "1" | ||||||||
# Run the "semgrep" command on the command line of the docker image. | ||||||||
- run: semgrep . --sarif --output semgrep.sarif | ||||||||
env: | ||||||||
# Connect to Semgrep Cloud Platform through your SEMGREP_APP_TOKEN. | ||||||||
# Generate a token from Semgrep Cloud Platform > Settings | ||||||||
# and add it to your GitHub secrets. | ||||||||
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} | ||||||||
# Add the rules that Semgrep uses by setting the SEMGREP_RULES environment variable. | ||||||||
# more at semgrep.dev/explore | ||||||||
SEMGREP_RULES: p/default | ||||||||
Comment on lines
+59
to
+61
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
Noting that |
||||||||
|
||||||||
# Upload SARIF file generated in previous step | ||||||||
- name: Upload SARIF file | ||||||||
|
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.